@khorsheed/dsh-ankh-guard 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # 变更记录
 
+## 0.4.2（2026-09-30）
+
+- **修复重启浮层卡死**：标签页带着 pending handoff 时，若 cutover 已不经由本标签页收口（操作员 restore、handoff off、监督链楔死），服务端对该 cutoverId 永远回 409，「正在重启」浮层会无限重试不下台。现在每 8 次失败 ACK 花一次 poll——`idle` 即证明没有在途事务，丢弃 pending 并收浮层。sessionStorage 按标签页存活，所以旧实例上已卡住的标签页不受影响此修复——关掉重开即可（3080 实测案例）
+
 ## 0.4.1（2026-09-30）
 
 修复 2026-09-29/30 的 0.2.0-rc.2 切换事故暴露的三个缺口：

package/lib/client.js

@@ -159,6 +159,8 @@ window.__ModuleLoader__.load({
 			let timer;
 			let pending = consumeFallbackFragment() ?? readPending();
 			let cap;
+			/** Consecutive failed ACKs for the current pending handoff. */
+			let ackFailures = 0;
 			let errorRetryMs = ERROR_RETRY_MIN_MS;
 			let firstFailureAt;
 			let request;
@@ -226,6 +228,22 @@ window.__ModuleLoader__.load({
 								location.replace(returnPath);
 								return;
 							}
+						} else {
+							ackFailures += 1;
+							if (ackFailures >= 8) {
+								ackFailures = 0;
+								const probe = await post({
+									version: 1,
+									operation: "poll",
+									capability: cap ??= capability()
+								}, current.signal);
+								if (stale()) return;
+								if (probe.ok && (await probe.json()).state === "idle") {
+									sessionStorage.removeItem(PENDING_KEY);
+									sessionStorage.removeItem(CAPABILITY_KEY);
+									pending = null;
+								}
+							}
 						}
 						errorRetryMs = ERROR_RETRY_MIN_MS;
 						firstFailureAt = void 0;
@@ -278,6 +296,7 @@ window.__ModuleLoader__.load({
 						};
 						pending = nextPending;
 						writePending(nextPending);
+						ackFailures = 0;
 						waitingOverlay();
 						location.reload();
 						return;
@@ -299,6 +318,7 @@ window.__ModuleLoader__.load({
 						};
 						pending = nextPending;
 						writePending(nextPending);
+						ackFailures = 0;
 						waitingOverlay();
 						location.replace(launch.href);
 						return;

package/lib/types/client/index.js

@@ -155,6 +155,8 @@ export function apply(_ctx) {
     let timer;
     let pending = consumeFallbackFragment() ?? readPending();
     let cap;
+    /** Consecutive failed ACKs for the current pending handoff. */
+    let ackFailures = 0;
     let errorRetryMs = ERROR_RETRY_MIN_MS;
     let firstFailureAt;
     let request;
@@ -231,6 +233,29 @@ export function apply(_ctx) {
                         return;
                     }
                 }
+                else {
+                    // A failed ACK can be permanent: the cutover settled without this tab
+                    // (operator restore, handoff off, a wedged supervisor) and the server
+                    // keeps answering 409 'waiting'/'stale' for a dead cutoverId — the
+                    // veil would otherwise stay up forever (observed 2026-09-30). Every
+                    // few failures, spend one poll: 'idle' proves nothing is in flight,
+                    // so the pending handoff is dead — drop it and let the ordinary
+                    // poll loop remove the veil on the next tick.
+                    ackFailures += 1;
+                    if (ackFailures >= 8) {
+                        ackFailures = 0;
+                        const probe = await post({
+                            version: 1, operation: 'poll', capability: cap ??= capability(),
+                        }, current.signal);
+                        if (stale())
+                            return;
+                        if (probe.ok && (await probe.json()).state === 'idle') {
+                            sessionStorage.removeItem(PENDING_KEY);
+                            sessionStorage.removeItem(CAPABILITY_KEY);
+                            pending = null;
+                        }
+                    }
+                }
                 errorRetryMs = ERROR_RETRY_MIN_MS;
                 firstFailureAt = undefined;
                 schedule(ACTIVE_RETRY_MS);
@@ -287,6 +312,7 @@ export function apply(_ctx) {
                 };
                 pending = nextPending;
                 writePending(nextPending);
+                ackFailures = 0;
                 waitingOverlay();
                 location.reload();
                 return;
@@ -307,6 +333,7 @@ export function apply(_ctx) {
                 };
                 pending = nextPending;
                 writePending(nextPending);
+                ackFailures = 0;
                 waitingOverlay();
                 // The bearer remains a local variable for the shortest possible time.
                 location.replace(launch.href);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@khorsheed/dsh-ankh-guard",
   "description": "Hard gate for self-modification restarts: a green-build credential bound to the git HEAD, checked before any restart of the running instance",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",